Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

IBM DataPower Gateway may stop handling requests

CVE-2026-15822 · published 27 days ago
Summary

Versions of IBM DataPower Gateway (10.5.0 through 10.5.0.22, 10.6.0 through 10.6.6 and 11.0.0 through 11.0.0.2) can be forced to halt by a specially crafted GraphQL query. This could make the gateway unavailable and interrupt the flow of data between your systems. Apply the latest patches from IBM or upgrade to a fixed version as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm datapower gateway 10.6cd <= 10.6.6
ibm datapower gateway 10.6.0 <= 10.6.0.10
ibm datapower gateway 11.0.0 <= 11.0.0.2
ibm datapower gateway 10.5.0 <= 10.5.0.22
Original advisory text
IBM DataPower Gateway Denial of Service
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-405Asymmetric Resource Consumption (Amplification)
Timeline
Published8 Oct 2026
Updated31 Oct 2026
First seen8 Oct 2026
Sources
CVE-2026-15822 · NVD
CVE-2026-15822 · MITRE
Track software like this
Free during beta